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Executive  Summary 

Of  all  the  critical  infrastructures,  the  security  of  the 
drinking  water  and  wastewater  industries  (water 
sector)  have  the  most  immediate  and  pervasive 
impact  upon  the  public’s  health  and  welfare.1 
Accordingly,  an  unprecedented  level  of  industry- 
government  cooperation  is  necessary  to  effectively 
plan,  prepare,  respond,  and  recover  from  terrorist 
attacks  and  natural  disasters. 

While  industry  representatives  have  expended 
considerable  effort  to  participate  in  the  full  range  of 
infrastructure  protection  activities  associated  with 
mitigating  risk  in  the  Nation’s  water  sector — and 
achieved  substantial  progress  in  doing  so — there 
is  a  sense  that  progress  may  be  too  slow  and  the 
response  may  be  incomplete.  A  comprehensive 
strategy  that  streamlines  and  drives  the  efforts  of 
industry  and  government  is  needed  to  prepare  for 
the  needs  of  tomorrow. 

“One  of  the  challenges  we  face  is. ..defining 
what  it  means  to  be  prepared,  so  as  to 
transform  awareness  into  action.” 

—  Benjamin  H.  Grumbles,  Assistant 
Administrator  for  Water,  U.S.  EPA, 

The  CIP  Report,  October  20072 

An  Urgent  Need 

Infrastructure  protection  is  a  shared  responsibility; 
the  Water  Sector  Coordinating  Council  (WSCC) 
represents  the  industry  side  of  the  water  sector  s 
industry-government  partnership.  The  WSCC 
provides  the  means  to  quickly  bring  together 
sector  leaders  and  essential  resources  when  needed 
to  address  critical  issues  and  act  quickly  and 
decisively.  However,  implementing  the  escalating 
multitude  of  security  improvements  required  by 
homeland  security-related  national  strategies, 
presidential  directives,  and  drinking  water 
and  wastewater  environmental  laws  may  soon 
overwhelm  WSCC  members,  who  volunteer  their 
time  and  resources.  The  urgent  need  to  operate 
efficiently  and  focus  on  the  priority  issues  of  the 
water  sector  has  prompted  the  WSCC  to  develop  a 
unified  strategy. 


Industry  Leadership 

WSCC  efforts  have  produced  this  WSCC  Strategic 
Roadmap ,  which  presents  a  vision  and  supporting 
framework  of  goals  and  tactics  for  securing  the 
water  sector  over  the  next  12  months.  This  strategic 
framework  enables  industry  and  government  to 
align  their  programs  and  investments  to  improve 
critical  infrastructure  protection  in  an  expedient 
and  efficient  manner.  This  strategic  roadmap 
integrates  the  insights  and  ideas  of  WSCC 
members,  owners  and  operators,  and  associations 
who  met  during  workshops  held  in  February  and 
May  2008. 

The  Vision 

By  implementing  this  Strategic  Roadmap,  the 
WSCC  believes  that  the  sector  can  uphold  its 
vision  for  security: 


The  water  sector  s  security  vision 
is  a  secure  and  resilient  drinking 
water  and  wastewater  infrastructure 
that  provides  clean  and  safe  water 
as  an  integral  part  of  daily  life. 


This  vision  assures  the  economic  vitality  of  and 
public  confidence  in  the  Nation’s  drinking  water 
and  wastewater  through  a  layered  defense  of 
effective  preparedness  and  security  practices  in  the 
sector.3 

A  Strategic  Framework 

The  WSCC  will  pursue  the  following  strategic  goals 
in  an  effort  to  realize  the  sector’s  vision  for  security. 
These  goals  will  drive  development  of  protective 
programs  and  measures  of  success. 

Sustain  protection  of  public  health  and  the 
environment.  The  WSCC  aims  to  help  water 
sector  utilities  complete  and  exercise  consequence 
management  and  security  preparedness  plans. 

Recognize  and  reduce  risks  in  the  water 
sector.  To  better  inform  decision  makers  on  the 
appropriate  levels  and  allocation  of  risk  mitigation 
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Strategic  Roadmap  Scope 

This  Strategic  Roadmap  considers  all  variables 
for  improving  the  preparedness  and  security 
practices  in  the  sector,  including: 

■  Water  and  wastewater  infrastructures 

■  Physical,  human,  and  cyber  applications 

■  Full  spectrum  of  protective  activities: 
prevention,  detection,  response  to,  and 
recovery  from  terrorist  attacks,  other 
intentional  acts,  natural  disasters,  and 
other  hazards 

■  Priority  security  issues  for  the  WSCC 

■  One-year  time  frame 

measures,  the  WSCC  will  facilitate  the  exchange 
of  screened,  validated,  and  timely  vulnerability  and 
threat  information  among  sector  partners. 

Maintain  a  resilient  infrastructure.  The  WSCC 
will  facilitate  the  completion  and  practice  of 
business  continuity  and  emergency  response  plans 
to  optimize  the  business  operations  of  water  sector 
utilities  and  ensure  their  economic  vitality,  as  well 
as  the  communities  they  serve. 

Increase  communication,  outreach,  and  public 
confidence.  To  foster  public  confidence,  the 
WSCC  will  aid  in  the  development  of  crisis 
communication  plans  and  collaborative  emergency 
preparedness  and  incident  response  networks. 


Top  Priority  Activities 

The  WSCC  believes  the  following  top  priority 
actions  must  be  pursued  to  significantly  mitigate 
risk  in  the  water  sector: 


Top  Priority  Activities 
(in  alphabetical  order) 


■  Align  security  partner  (i.e.,  U.S.  Environmental 
Protection  Agency  [EPA]  and  Department  of 
Homeland  Security  [DHS])  priorities  with  water 
sector  needs. 

■  Develop  strategy  for  managing  government  (i.e., 
EPA,  DHS)  workload. 

■  Engage  with  local  emergency  managers. 

■  Maximize  response  to  Critical  Infrastructure 
Partnership  Advisory  Council  (CIPAC)  Metrics 
Survey. 

■  Promote  to  government  a  flexible  and  scalable 
approach  to  the  Risk  Assessment  Methodology  for 
Critical  Asset  Protection. 

■  Provide  guidance  on  business  continuity/continuity 
of  operations  planning  in  the  water  sector. 

■  Provide  guidance  on  consequence  management 
plan  detection  of  contamination  protocols. 

■  Provide  guidance  on  water  and  wastewater  utility 
responder  communications. 

The  WSCC  plans  to  take  immediate  action  and 
execute  these  top  priority  activities.  On  an  annual 
basis,  the  WSCC  will  refine  and  adapt  its  security 
efforts  to  accelerate  progress  toward  a  more 
resilient  water  sector  today  and  in  the  future. 


VI 
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I.  Introduction 

With  the  publication  of  this  document,  the 
drinking  water  and  wastewater  industries  (water 
sector)  continue  a  process  begun  decades  ago  to 
protect  human  health  and  the  environment.  This 
document  applies  the  framework  of  Sector-Specific 
Plan  (SSP)  goals  and  objectives  to  secure  critical 
infrastructures  in  the  water  sector. 

Infrastructure  protection  is  a  shared  responsibility; 
the  Water  Sector  Coordinating  Council  (WSCC) 
represents  the  industry  side  of  the  water  sector’s 
industry-government  partnership.  As  shown 
in  Table  1.1,  the  WSCC  provides  the  means 
to  quickly  bring  together  sector  leaders  and 
essential  resources  when  needed  to  address 
critical  issues  and  act  quickly  and  decisively. 
However,  implementing  the  escalating  multitude 
of  security  improvements  required  by  the  National 
Infrastructure  Protection  Plan  (NIPP)  and  other 
homeland  security-related  national  strategies, 
presidential  directives,  and  drinking  water 
and  wastewater  environmental  laws  may  soon 
overwhelm  WSCC  members,  who  volunteer  their 
time  and  resources. 

To  streamline  and  drive  ongoing  and  future 
efforts,  the  WSCC  developed  this  WSCC  Strategic 
Roadmap.  The  roadmap  focuses  on  the  highest 
priority  activities  needed  to  improve  the  security 
of  the  water  sector  during  the  years  2008-2009. 

The  roadmap  content  is  the  result  of  two  meetings 
held  by  members  of  the  WSCC  Strategic  Planning 
Working  Group  (SPWG).  For  more  information  on 
the  strategic  roadmap  development  process,  please 
refer  to  Appendix  A. 

Purpose 

This  strategic  roadmap  builds  on  existing 
government  and  industry  efforts  to  improve  the 
security  of  the  water  sector.  The  purposes  of  this 
strategic  roadmap  are  as  follows: 

■  Define  a  consensus-based  strategy  that 
articulates  the  priorities  of  owners  and 
operators  in  the  water  sector  to  manage  and 
reduce  risk. 

■  Produce  an  actionable  path  forward  for  the 
WSCC  to  improve  the  security,  preparedness, 
resilience,  and  response/recovery  of  the  water 
sector  in  2008-2009. 


Table  1.1  WSCC  Takes  Action,  Provides  Results 

M fSCC  Takes  Action,  Provides  Results 

In  September  2004,  the  WSCC  was  formed 
by  eight  of  the  preeminent  water  and 
wastewater  organizations:  American  Water 
Works  Association  (AWWA),  AWWA 
Research  Foundation  (AwwaRF),  Association 
of  Metropolitan  Water  Agencies  (AMWA), 
National  Association  of  Clean  Water  Agencies 
(NACWA),  National  Association  of  Water 
Companies  (NAWC),  National  Rural  Water 
Association  (NRWA),  Water  Environment 
Federation  (WEF),  and  Water  Environment 
Research  Foundation  (WERF).  The  WSCC 
consists  of  16  owner /operator  representatives 
and  eight  association  staff.  All  members  are 
volunteers  and  have  no  budget  provided 
specifically  for  WSCC  initiatives. 

The  WSCC  has  taken  strides  to  mitigate  risk 
in  the  water  sector.  To  date,  the  WSCC  has 
developed  several  key  documents: 

■  Water  Sector  Coordinating  Council;  The 
First  Eighteen  Months;  input  to  the  2007 
Water  Sector  Annual  Report 

■  Recommendations  of  the  Critical 
Infrastructure  Protection  Advisory  Council 
(CIPAC)  Metrics  Workgroup  for  Water, 
WSCC  CIPAC  Metrics  Workgroup 

■  Roadmap  to  Secure  Control  Systems  in 
the  Water  Sector,  WSCC  Cyber  Security 
Working  Group 

The  WSCC  has  also  provided  great  support  to 
the  development  of  the  following  documents 
and  programs:  NIPP,  Water  SSP,  National 
Response  Framework,  Water/Wastewater 
Agency  Response  Network  (WARN),  Pandemic 
-  DHS  Annex,  Credentialing  -  National 
Incident  Management  System  (NIMS)  Public 
Works,  and  Water  Contaminant  Information 
Tool. 


Water  Sector  Coordinating  Council  Strategic  Roadmap 


1 


■  Guide  efforts  by  the  WSCC  to  plan,  develop, 
and  implement  water  security  measures. 

■  Promote  industry-government  partnership 
and  collaboration  to  effectively  and  efficiently 
implement  security  throughout  the  water 
sector. 

■  Encourage  extensive  engagement  among  key 
stakeholders  to  accelerate  security  advances 
throughout  the  water  sector. 

Scope 

The  strategic  roadmap  aims  to  provide  a 
comprehensive  strategy  to  address  the  most  urgent 
needs — including  physical,  human,  and  cyber 
elements — for  mitigating  risk  in  the  water  sector. 

It  is  consistent  with  the  SSP  risk  management 
framework  and  full  spectrum  of  protective 
activities:  prevention,  detection,  response  to,  and 
recovery  from  terrorist  attacks,  other  intentional 
acts,  natural  disasters,  and  other  hazards  as 
defined  in  the  NIPP.  This  roadmap  covers  goals, 
tactics,  and  activities  over  the  next  12  months. 
Security  activities  encompass  planning,  guidance 
documents,  outreach,  training,  risk  assessment 
tools,  metrics,  and  implementation. 


Strategic  Roadmap  Organization 

The  remainder  of  this  document  is  organized  as 
follows: 

■  Section  II  identifies  top  priority  activities 
that  emerged  from  the  strategic  roadmapping 
process  and  outlines  the  key  action  plans  to 
address  those  priorities. 

■  Section  III  describes  a  process  for  turning  the 
elements  of  the  strategic  roadmap  into  actions 
and  proposes  the  main  implementation  steps, 
including:  (i)  socialize  strategic  roadmap,  (ii) 
form  Top  Priority  Teams,  (iii)  implement  top 
priorities,  (iv)  communicate  results,  and  (iv) 
sustain  momentum. 

■  Section  IV  provides  water  sector  contacts  to 
find  more  information  about  this  strategic 
roadmap. 

■  Appendix  A  describes  the  strategic 
roadmapping  process  in  greater  detail. 

■  Appendix  B  discusses  the  fundamental  trends 
driving  water  sector  security  that  the  WSCC 
must  consider  while  preparing  for  the  future, 
including:  (i)  utility  resources,  (ii)  cross-sector 
interdependencies,  (iii)  legislation  and  policy, 
(iv)  public  awareness  and  outreach,  (v)  owner/ 
operator  business  environment,  and  (vi)  sector¬ 
wide  issues. 


■  Appendix  C  describes  a  comprehensive 
framework  for  water  security,  outlining 
the  sector  s  vision  and  goals,  including:  (i) 
sustain  protection  of  public  health  and  the 
environment;  (ii)  recognize  and  reduce 
risks  in  the  water  sector;  (iii)  maintain  a 
resilient  infrastructure;  and  (iv)  increase 
communication,  outreach,  and  public 
confidences. 
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II.  Top  Priority  Activities 


To  embark  on  its  water  sector  planning  and 
preparedness  efforts,  the  WSCC  has  set  eight  top 
priority  activities  out  of  the  more  than  50  needed 
activities  (listed  in  Appendix  C)  identified  by  the 
working  group.  The  working  group  established  the 
following  criteria  for  selecting  priority  activities: 

■  Priority  activities  must  be  aligned  with  the 
WSCC’s  mission. 

■  Priority  activities  should  result  in  a  significant 
and  needed  contribution  to  the  water  sector’s 
security  posture. 

■  Priority  activities  should  have  a  high  probability 
of  successful  implementation  within  a 
reasonable  timeframe  (about  one  year)  from 
project  initiation. 

The  WSCC  believes  these  top  priority  actions  must 
be  pursued  to  significantly  mitigate  risk  in  the 
water  sector.  If  achieved,  these  activities  together 
will  strengthen  the  sector’s  ability  to  anticipate 
security  incidents,  plan  for  effective  response  and 
recovery,  and  initiate  partnerships  that  facilitate 
a  comprehensive  approach  to  preparedness, 
prevention,  and  response. 


WSCC  Mission 

To  serve  as  a  policy,  strategy,  and  coordination 
mechanism  and  recommend  actions  to  reduce 
and  eliminate  significant  homeland  security 
vulnerabilities  to  the  water  sector  through 
interactions  with  the  Federal  government  and 
other  critical  infrastructures. 


The  top  priority  activities  for  the  WSCC  are  listed 
in  Table  2.1.  A  series  of  one-page  action  plans  for 
each  are  shown  on  the  following  pages.  Each  action 
plan  provides  a  more  detailed  description  of  the 
goal  for  each  priority;  identifies  the  key  challenges 
addressed  by  the  activity;  articulates  the  benefits  of 
the  WSCCs  involvement;  and  provides  preliminary 
lists  of  tasks,  potential  partners,  key  milestones, 
and  immediate  next  steps.  The  WSCC  can  use 
these  plans  to  take  immediate  action  and  accelerate 
progress  toward  a  more  resilient  water  sector. 

Table  2.1  Top  Priority  Activities  for  the  Water  Sector 


Top  Priority  Activities  for  the  Water 
Sector  (in  alphabetical  order) 


■  Align  security  partner  (i.e.,  U.S.  Environmental 
Protection  Agency  [EPA]  and  Department  of 
Homeland  Security  [DHS])  priorities  with  water 
sector  needs. 

■  Develop  strategy  for  managing  government  (i.e., 
DHS,  EPA)  workload. 

■  Engage  with  local  emergency  managers. 

■  Maximize  response  to  Critical  Infrastructure 
Partnership  Advisory  Council  (CIPAC)  Metrics 
Survey. 

■  Promote  to  government  a  flexible  and  scalable 
approach  to  the  Risk  Assessment  Methodology  for 
Critical  Asset  Protection  (RAMCAP). 

■  Provide  guidance  on  business  continuity/continuity 
of  operations  planning  in  the  water  sector. 

■  Provide  guidance  on  consequence  management 
plan  detection  of  contamination  protocols. 

■  Provide  guidance  on  water  and  wastewater  utility 
responder  communications. 
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Align  security  partner 

(i.e.,  EPA,  DHS)  priorities  with  water  sector  needs. 

Factor  sector  needs  into  security  partner  (i.e.,  EPA,  DHS)  priorities  to  ensure  resources  are  adequate 
for  maintaining  the  resilience  of  the  water  sector  critical  infrastructures. 

Background 

Many  agree  that  the  cost  of  implementing  adequate  security  measures  across  the  water  sector  could  cost  billions  of 
dollars.  While  no  crisis  exists  today  for  the  majority  of  systems,  one  could  develop  for  many  utilities  if  they  do  not 
substantially  increase  their  level  of  investment  in  security  measures  from  what  it  is  today.  Yet  utilities  are  faced  with  the 
challenge  of  balancing  efforts  to  keep  water  rates  low  with  the  need  for  rate  increases  to  fund  security  enhancements. 
Although  EPA  and  DHS  have  made  Federal  resources  available  to  help  secure  the  water  sector,  competing  Federal 
priorities  often  consume  most  of  the  funds  and  little  remains  for  the  utilities'  use. 

The  WSCC  recognizes  that  key  judgments  need  to  be  made  about  who  should  receive  priority  for  Federal  resources, 
and  how  those  resources  should  be  used,  as  the  water  sector  faces  uncertainties  about  the  threat  of  an  attack  or  natural 
disaster.  With  knowledge  and  technical  expertise  across  the  full  range  of  critical  infrastructure  protection  activities 
and  issues,  the  WSCC  can  assist  EPA,  DHS,  and  other  security  partners  as  they  seek  the  best  way  to  allocate  limited 
resources  to  reduce  the  risk  to  the  Nation's  drinking  water  supply  and  wastewater  infrastructure. 

Key  Challenges 

Benefits 

■  Staggering  scale  of  investment  needed  to  improve 
security  in  the  water  sector 

■  Competing  priorities  constrain  security 
improvements 

■  Lack  of  awareness  and  understanding  by  Federal 
agencies  and  public  officials  on  the  critical  needs  of 
the  water  sector 

■  Limited  awareness  and  understanding  by  the  water 
sector  on  Federal  priorities 

■  Limited  resources  for  training  and  conducting 
emergency  simulations  at  the  utility  level 

■  Increased  opportunities  to  leverage  EPA  and  DHS 
resources  and  address  unmet  needs 

■  Accelerated  progress  to  enhanced  water  security 
postures  by  addressing  needs  with  adequate  resources 

■  Greater  impact  and  reach  of  Federal  resources 

■  Improved  workflow  between  EPA  and  DHS 
through  improved  understanding  of  sector  security 
requirements 

Tasks 

1.  Form  joint  working  group  to  cross-walk  SCC  priorities  with  GCC  priorities. 

2.  Identify  opportunities  to  partner  with  EPA,  DHS,  and  other  stakeholders  on  sector  priorities. 

3.  Develop  approach  to  collaborate  and  leverage  resources  for  each  priority. 

4.  Prepare  and  submit  resource  plans  to  increase  stakeholder  buy-in. 

5.  Manage  and  direct  resources  to  implement  priorities. 

6.  Track  progress  and  develop  methods  to  improve  success  rate. 

Champion 

Key  Milestones 

Immediate  Next  Steps 

■  Rick  Karlin,  AwwaRF 

Potential  Partners 

■  WERF 

■  Resource  partners  identified 

■  Resource  requests  submitted 

■  Resources  awarded 

■  Priorities  developed  and 
implemented 

■  Form  joint  working  group 

■  Identify  partnership 
opportunities 
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Develop  strategy  for  managing  government  (i.e., 

EPA,  DHS)  workload. 

Develop  an  appropriate  process  within  the  water  sector  to  prioritize  new  government  security 
initiatives  and  manage  the  potential  barrage  of  requests. 

Background 

The  WSCC  serves  as  the  mechanism  to  facilitate  organization  and  coordination  of  security  implementation  activities 
with  EPA  and  DHS.4  Since  2004,  the  WSCC's  workload  has  quadrupled  and  it  has  processed  hundreds  of  requests  for 
information.  To  manage  this  workload  and  establish  priorities,  dialogue  with  owner-operators,  associations,  and  subject 
matter  experts  is  crucial.  While  the  WSCC  already  works  closely  with  its  members,  efforts  must  be  more  concrete  and 
directed.  A  Security  Water  Association  Team  (SWAT),  composed  of  representatives  from  the  SCC  associations  was 
formed  in  2008  to  begin  addressing  these  issues.  While  progress  has  been  made,  the  sector  needs  to  recognize  the  roles 
and  responsibilities  of  SWAT  and  understand  how  the  sector  should  respond  when  they  receive  requests  initiated  by 
SWAT. 

A  government  workload  strategy  that  optimizes  the  efforts  of  the  WSCC  and  expertise  of  the  sector  can  provide  a 
mutually  efficient  means  to  interact  with  the  government.  The  strategy  can  also  help  to  address  the  growing  government 
demand  for  vital  security  information. 

Key  Challenges 

Benefits 

■  Difficult  to  cope  with  burgeoning  workload 

■  Information  overload  limits  sector  uptake  of  and 
response  to  security  initiatives 

■  Lack  of  time  and  clarity  from  government  hampers 
industry's  ability  to  generate  comprehensive  and 
useful  reports 

■  Ensure  the  responsiveness,  efficiency,  and 
effectiveness  of  WSCC 

■  Increase  awareness  and  implementation  of  critical 
security  issues  throughout  the  water  sector 

■  Increase  quality  of  information  flowing  between 
government  and  industry 

Tasks 

1.  Form  an  internal  working  group,  known  as  Security  Water  Association  Team  (SWAT),  to  determine  monthly 
workload  strategy  and  collaborate  with  ongoing  efforts. 

2.  Announce  the  formation  of  SWAT  and  communicate  expectations  of  this  initiative. 

3.  Assess  government  requests  and  available  resources. 

4.  Determine  process  and  structure  for  managing  government  workload 

5.  Prepare  and  communicate  requests  to  appropriate  stakeholders,  including  annual  government  requirements  and 
expected  WSCC  response. 

6.  Gather  information  and  respond  to  government  requests  accordingly. 

7.  Assess  and  promote  progress  on  a  regular  basis. 

Champions 

Key  Milestones 

Immediate  Next  Steps 

■  Paula  Dannenfeldt,  NACWA 

■  Lynn  Stovall,  Greenville  Water 
System 

■  Bill  Komianos,  American  Water 

Potential  Partners 

■  AMWA,  AWWA,  AwwaRF, 
NACWA,  NAWC,  NRWA,  WEF, 
and  WERF 

■  Internal  working  group  (SWAT) 
formed 

■  SWAT  role,  responsibilities,  and 
expectations  developed 

■  Requests  coordinated  and 
addressed 

■  Communicate  role  of  the  SWAT 
to  the  water  sector 

■  Assess  government  requests 
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Engage  with  local  emergency  managers. 


Foster  greater  partnership  between  utilities  and  local  emergency  responders  to  improve  local 
preparedness  and  improve  National  Incident  Management  System  (NIMS)  compliance. 

Background 

To  successfully  prepare  for,  respond  to,  and  recover  from  emergencies,  utilities  must  engage  in  adequate  emergency 
response  planning  and  training,  while  developing  ongoing  relationships  with  local  emergency  responders.  Stronger 
relationships  within  a  utility  (internal  and  cross-organizational)  and  between  utilities  and  local  responders  reinforce 
response  roles  and  improve  trust  and  confidence  that  duties  will  be  implemented  effectively  during  an  emergency. 
However,  utilities  have  made  only  modest  outreach  to  local  emergency  responders,  hampering  emergency  response  plan 
(ERP)  development  and  understanding  of  how  to  react  to  a  crisis. 

Confusion  about  how  to  make  ERPs  comply  with  the  NIMS  has  further  complicated  ERP  development  and  prevented 
utilities  from  accessing  Federal  preparedness  assistance  to  support  training.  Improved,  NIMS -compliant  ERPs  will 
enable  utilities  to  access  financial  assistance  that  will  aid  training  activities  to  prepare  the  workforce  with  the  knowledge 
and  skills  to  fully  engage  in  emergency  planning  and  response. 


Key  Challenges 

Benefits 

■  Lack  of  partnership  between  utilities  and  local 
emergency  responders  creates  confusion 

■  Limited  resources  for  emergency  response  training 

■  Difficulty  of  NIMS  language  and  concepts;  lack  of 
clear  government  training  on  NIMS 

■  Stronger  emergency  response  through  improved 
relationships  and  trust  among  local  emergency 
responders  and  utilities 

■  Problems  anticipated  during  planning  and  training 
exercises 

■  Bolstered  utility  readiness  to  effectively  respond  to 
an  emergency  through  increased  competence  and 
confidence 

Tasks 


1.  Form  internal  working  group  to  review  and  assess  current  state  of  partnerships  among  utilities  and  local  emergency 
responders,  including  progress  with  mutual/aid  assistance  (i.e.,  Water  Wastewater  Agency  Response  Network 
[WARN]). 

2.  Develop  guidance  materials  to  help  utilities  address  partnership  development  needs. 

3.  Team  with  associations  to  provide  training  on  ERP/NIMS  terminology  and  compliance. 

4.  Promote  and  disseminate  guidance  materials  throughout  the  water  sector. 

5.  Assess  and  revise  the  guidance  materials  on  a  regular  basis. 


Champion 

Key  Milestones 

Immediate  Next  Steps 

■  Internal  Working  Group 

■  Working  group  formed 

■  Form  internal  working  group 

Potential  Partners 

■  Partnership-building  needs 

■  Begin  developing  partnership¬ 

■  AMWA,  AWWA,  AwwaRF, 

assessed 

building  strategy 

NACWA,  NAWC,  NRWA,  WEF, 

■  ERP/NIMS  training  delivered 

and  WERF 

■  Partnership  guidance 
disseminated 
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Maximize  response  to  CIPAC  Metrics  Survey. 


Encourage  strong  response  to  the  first  CIPAC  Metrics  Survey  to  increase  understanding  of  the  water 
sector  s  security  posture. 

Background 

While  vulnerability  assessments  have  improved  a  utility's  understanding  of  the  risk  to  its  critical  systems,  the  capabilities 
to  fully  understand  the  risk  at  the  local,  regional,  and  national  level  have  just  begun  to  take  shape.  To  gain  a  full 
understanding  of  risk,  the  water  sector  requires  quantifiable  data.  A  lack  of  data  hampers  the  sector's  ability  to  build  a 
compelling  business  case  for  security  improvements.  Without  data,  it  is  difficult  to  convince  the  government  that  the 
sector  needs  more  resources  to  maintain  an  adequate  security  posture.  Worse  yet,  poorly  defined  risk  makes  it  difficult 
for  utilities  to  convince  the  public  that  it  is  doing  a  good  job. 

Utilities  will  have  an  opportunity  to  report  on  their  security  posture  with  the  release  of  the  first  CIPAC  Metrics  Survey 
in  fall  2008.  By  facilitating  a  sector-wide  response  to  this  first  Metrics  Survey,  the  sector  can  better  quantify  a  utility's 
risk,  establish  a  baseline  of  security  measures  implemented,  and  develop  a  data  set  for  measuring  and  communicating 
future  progress  toward  achieving  sector  security  goals. 


Key  Challenges 

Benefits 

■  Lack  of  data  to  measure  progress  toward  water-sector 
security  goals 

■  Limited  acceptance  of  a  consistent  reporting 
structure  for  collection,  retention,  and  protection  of 
information/ reports 

■  Utilities'  concern  about  reporting  data  that  might 
uniquely  identify  their  performance 

■  Improved  understanding  of  risk  for  improved  decision 
making 

■  Increased  resources  to  address  priority  security  needs 

■  Established  mechanism  for  tracking  progress  toward  a 
secure  and  resilient  water  sector 

■  Improved  ability  to  manage  public  expectations 

Tasks 


1.  Develop  and  execute  an  outreach  strategy  to  encourage  utilities  to  respond  to  the  Metrics  Survey. 

2.  Collaborate  with  associations  to  provide  training  on  survey  features  and  the  metrics  themselves  to  increase  comfort 
with  the  terminology  and  demonstrate  action. 

3.  Encourage  continued  response  to  the  Metrics  Survey  in  future  data  collection  years. 

4.  Analyze  data  regularly  to  identify  strengths  and  weaknesses  in  the  water  sector's  overall  security  posture. 


Champions  and  Potential  Partners 

■  AMWA,  AWWA,  AwwaRF, 
NACWA,  NAWC,  NRWA,  WEF, 
and  WERF 


Key  Milestones 

■  Metrics  Survey  letter  sent 

■  Training  on  survey  features  and 
metrics  given 

■  Survey  data  analyzed 


Immediate  Next  Steps 

■  Initiate  outreach  efforts  to 
improve  response  to  Metrics 
Survey 

■  Identify  association  champions  to 
deliver  survey  training 
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Promote  to  government  a  flexible  and  scalable  approach  to  the  Risk  Assessment 
Methodology  for  Critical  Asset  Protection  (RAMCAP). 


Ensure  implementation  of  RAMCAP  is  workable  and  cost-effective  in  all  water  systems — especially 
small  systems — by  supporting  a  flexible  and  scalable  approach  to  vulnerability  assessment  (VA). 

Background 

VAs  help  utilities  evaluate  their  susceptibility  to  threats  and  identify  corrective  actions  that  might  reduce  or  mitigate  the 
risk  of  serious  consequences  from  adversarial  actions.  As  required  under  the  Bio-Terrorism  Act  of  2002,  water-sector 
utilities  have  completed  their  VAs.  However,  different  models  were  used  depending  on  utility  size,  treatment  method, 
and  population  served.  Since  then,  RAMCAP  was  developed  to  provide  a  consistent  measurement  system  and  produce 
results  that  are  comparable  at  the  sector  and  cross-sector  levels.  Although  utilities  are  not  required  to  use  RAMCAP, 
government  agencies  are  using  it  to  help  prioritize  Federal  resource  allocations. 

Small  systems  make  up  more  than  90%  of  the  country's  approximately  50,000  community  water  supplies  and  are  less 
able  to  pay  for  additional  Federal  initiatives.  However,  to  be  compatible  with  RAMCAP,  small  systems  may  need  to 
reconstruct  their  VAs  and  use  a  model  designed  for  larger  systems.  This  model  is  more  complex  and  expensive  than  their 
current  model  and  may  be  beyond  a  small  systems  technical  capabilities.1 2 3 4 5 6  To  address  these  issues,  a  RAMCAP  working 
group  composed  of  representatives  from  WSCC  and  GCC,  and  subject  matter  experts  was  formed  in  2007.  While 
significant  progress  has  been  made,  improved  VA  models  and  additional  resources  are  needed  to  ensure  widespread 
adoption  of  RAMCAP  in  the  water  sector. 


Key  Challenges 


Difficult  to  apply  uniform  VA  models  to  large  number 
of  diverse  water  and  wastewater  utilities 

VA  tools  are  not  fully  effective  across  the  sector 

Lack  of  technical  capacity  and  resources  at  small 
systems  to  address  complex  VA  models 


Benefits 


Increased  alignment  and  support  of  RAMCAP 
Reduced  burden  on  small  systems 

Improved  information  for  better  risk  management 
decisions 


Tasks 


1.  Continue  development  of  RAMCAP  working  group  plan. 

2.  Review  draft  RAMCAP  Plan  for  the  Water  Sector  and  gain  consensus. 

3.  Prepare  final  RAMCAP  Plan. 

4.  Find  resources  and  secure  funding. 

5.  Implement  plan. 

■  Conduct  training  through  regional  workshops. 

■  Provide  on-site  assistance. 

6.  Assess  progress. 


Champions 


Bruce  Larson,  American  Water 
Ed  Thomas,  NRWA 
RAMCAP  Working  Group 


Key  Milestones 


RAMCAP  Working  Group  Plan 
developed 

Training  conducted 

RAMCAP  adopted  throughout 
the  water  sector 


Immediate  Next  Steps 


Complete  RAMCAP  working 
group  Plan 
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Provide  guidance  on  business  continuity/continuity  of  operations  planning  in  the 

water  sector. 

Develop  a  viable  and  reasonable  approach  to  developing  business  continuity  plans  (BCPs)  for  private 
utilities  and  continuity  of  operations  plans  (COOPs)  for  public  utilities  throughout  the  water  sector. 

Background 

Closely  related  to  consequence  management  plans,  BCPs/COOPs  ensure  a  utility  s  essential  functions  and  critical 
resources  continue  to  perform  during  and  after  an  emergency  situation.  BCPs/COOPs  define  how  a  utility  will  continue 
its  everyday  business  functions  in  a  not-so-everyday  environment.  Plans  address  the  potential  financial  effects  of  a  crisis, 
as  well  as  the  utility  s  flexibility  to  adapt  human  resource  policies  to  meet  the  changing  needs  of  employees.6 

Although  utilities  recognize  that  BCPs/COOPs  help  to  manage  risk,  there  is  a  lack  of  clear  and  simple  information  on 
plan  design,  and  many  utilities  simply  do  not  know  where  to  start.  Guidance  that  includes  information  on  how  to  access 
Federal  funding  is  an  essential  first  step.  Best  practices  for  training  and  testing  will  avoid  complacency  and  help  to 
identify  weak  and  unworkable  contingencies  within  the  plan. 

Key  Challenges 

Benefits 

■  Limited  resources  available  for  BCP/COOP 
development,  training,  simulations,  etc. 

■  Limited  awareness  of  the  need  to  show  conformance 
with  National  Incident  Management  System  (NIMS) 
to  access  funding 

■  Municipalities  and  states  have  not  approved  BCPs/ 
COOPs  across  the  sector  or  made  plan  requirements 
consistent 

■  Small  utilities  often  mistake  BCPs/COOPs  for 
emergency  response  plans 

■  Accelerated  development  of  BCPs/COOPs 
throughout  the  water  sector 

■  Enhanced  resilience  of  water  service 

■  Improved  disaster  preparedness 

■  Increased  potential  to  survive  an  emergency 

■  Enhanced  decision  making  during  a  crisis 

■  Improved  protection  of  the  value  of  water 

Tasks 

1.  Form  internal  working  group  to  review  available  BCP/COOP. 

2.  Assess  the  current  state  of  BCP/COOP  development  among  utilities,  including  lessons  learned  from  responding  to 
recent  natural  disasters. 

3.  Develop  guidance  materials  to  help  utilities  address  BCP/COOP  needs. 

4.  Promote  and  disseminate  guidance  materials  at  conferences,  through  associations,  websites,  etc. 

5.  Assess  progress  and  revise  annually. 

Champion 

Key  Milestones 

Immediate  Next  Steps 

■  Alan  Roberson,  AWWA 

Potential  Partners 

■  AMWA,  AwwaRF,  NACWA, 
NAWC,  NRWA,  WEF,  and 

WERF 

■  Working  group  formed 

■  Guidance  drafted 

■  Final  guidance  released 

■  Guidance  implemented 

■  Form  internal  working  group 

■  Integrate  existing  efforts 
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Provide  guidance  on  consequence  management  plan  detection  of  contamination 

protocols. 


Enhance  consequence  management  planning  to  position  the  water  sector  to  identify  and  respond  to 
a  wide  variety  of  water  quality  contaminants/anomalies. 

Background 

Consequence  management  plans  (CMPs)  outline  protocols  governing  the  response,  recovery,  and  remediation  actions 
that  a  utility  will  take  when  it  receives  a  threat  warning  from  its  contamination  warning  system.7,8  A  major  challenge 
for  utility  staff  is  to  effectively  manage  multiple  product  quality,  delivery,  and  security  objectives  while  maintaining 
regulatory  compliance  and  affordability  of  drinking  water  and  wastewater  services.  The  interrelationships  of  these 
objectives  are  complex,  and  available  literature  can  be  confusing.  Supplemental  monitoring  costs  are  difficult  to  justify, 
especially  in  a  small  system.  In  addition,  the  mix  and  number  of  contaminants  are  extremely  diverse  and  numerous, 
making  it  impractical  to  manage  the  risk  of  all  possible  contamination  events. 

Water  and  wastewater  utilities  lack  both  adequate  guidance  on  the  scope  of  data  collection  required  for  contamination 
detection,  and  clear,  well-defined  CMPs  (and  other  tools)  that  define  roles  and  responsibilities  in  decision-making  and 
response.  By  developing  clear  guidance  for  utilities  and  associations  on  consequence  management  planning,  the  WSCC 
can  help  utilities  evaluate  and  prioritize  treatment  and  monitoring  options  for  multiple  interdependent  product  quality 
objectives.  In  addition,  utilities  will  be  better  prepared  to  quickly  and  effectively  determine  the  credibility  of  a  detected 
threat  and  take  appropriate  response,  recovery,  and  remediation  actions. 


Key  Challenges 

Benefits 

■  Protocols  for  water  quality  anomalies  are  not  well 
defined 

■  Limited  focus  on  intentional  contamination 

■  Poorly  defined  roles/responsibilities  and  lack  of 
decision  support  tools  for  credibility  determination, 
threat  assessment,  and  transition  from  standard 
operations  management  to  consequence  management 

■  Lack  of  performance  standards  for  contamination 
detection 

■  Increased  preparedness  and  resiliency  to  ensure 
continuity  of  services 

■  Improved  decision-making  about,  and  response  to, 
detected  contaminant  events 

■  Rapid  and  effective  transition  from  routine  operations 
to  consequence  management  actions 

■  Effective  coordination  of  activities  among 
organizations  with  a  decision/response  role 

Tasks 


1.  Form  internal  working  group  to  review  available  consequence  management  planning  materials,  (i.e.,  EPAs  Water 
Sector  Interim  Consequence  Management  Plan  Guidance). 

2.  Assess  the  current  state  of  consequence  management  planning  among  utilities,  including  lessons  learned  from 
responding  to  recent  natural  disasters. 

3.  Develop  guidance  materials  to  help  utilities  address  partnership  development  needs. 

4.  Promote  and  disseminate  guidance  materials  throughout  the  water  sector. 

5.  Assess  awareness  and  status  of  implementation  among  operations. 

■  Gather  utilities’  feedback  and  revise  the  guidance  materials  on  a  regular  basis. 

6.  Assess  progress  and  revise  annually. 


Champions 

Key  Milestones 

Immediate  Next  Steps 

■  Don  Broussard,  Lafayette 

Utilities  System 

■  Patty  Cleveland,  Trinity  River 
Authority  of  Texas 

Potential  Partners 

■  AMWA,  AWWA,  AwwaRF, 
NACWA,  NAWC,  NRWA,  WEF, 
and  WERF 

■  EPA  CMP  guidance  promoted 

■  Workshops  conducted 

■  Supplemental  CMP  tools 
developed 

■  Monitor  the  release  of  EPA  CMP 
guidance 

■  Form  detection  standards 
working  group 

■  Form  decision  support  working 
group 
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Provide  guidance  on  water  and  wastewater  utility  responder  communications. 


Develop  materials  to  guide  utilities  in  communicating  during  a  crisis  and  maintaining  outreach 
during  non-crisis  periods. 

Background 

Risk  communication— whether  effective  or  not— will  directly  influence  what  happens  following  a  potentially 
compromising  event.  For  example,  an  effective  message  can  provide  needed  information  to  garner  support  or  calm  a 
nervous  public,  while  a  poor  statement  can  undermine  public  trust  or  confidence  and  possibly  aggravate  a  situation. 

To  be  effective,  a  utility  responder  communications  plan  should  include  a  chain-of-command  that  clearly  defines  the 
roles  and  responsibilities  of  all  personnel  during  crisis  and  non-crisis  periods.  By  establishing  who  does  what  and  when, 
a  utility  will  be  able  to  rapidly  notify  the  appropriate  personnel  to  activate  and  execute  a  timely  and  effective  response 
to  an  emergency.  Ongoing  two-way  communication  among  the  public,  news  media,  policy  makers,  water /waste water 
utilities,  regulatory  agencies,  public  health  officials,  emergency  responders,  and  other  authorities  involved  in  emergency 
response  and  recovery  will  greatly  improve  relationships  over  time. 

Currently  there  are  utilities  with  limited  awareness  of  available  resources  and  appropriate  outlets  for  public 
communication.  Others  have  difficulty  determining  if  and  when  to  communicate.  In  addition,  there  is  confusion 
over  who  “owns”  which  piece(s)  of  the  message.  By  guiding  utilities  to  develop  comprehensive  utility  responder 
communication  plans,  the  WSCC  can  strengthen  local  networks  in  the  water  sector  and  ensure  utilities  receive  the  help 
they  need  in  an  emergency  situation. 


Key  Challenges 

Benefits 

■  Negative  relationship  with  media  limits  outreach 

■  General  public  mistrust;  difficulty  of  restoring  public 
confidence 

■  Release  of  fragmented  messages  from  various  agencies 

■  Uncertainties  about  how  best  to  communicate  with 
the  public  and  emergency  response  personnel 

■  Maintained  and  enhanced  public  confidence  in  the 
water  sector 

■  Simpler  crisis  communication  decision  making; 
defined  communication  roles  and  responsibilities 
ensure  a  unified  message 

■  Rapid  communication  response  during  crises 
effectively  supports  health  and  safety  interests 

Tasks 


1.  Form  internal  working  group  to  review  available  communications  materials  (i.e.,  EPAs  message-mapping  activities). 

2.  Assess  the  current  state  of  crisis  and  non-crisis  communication  planning  among  utilities,  including  lessons  learned 
from  responding  to  recent  natural  disasters. 

3.  Develop  guidance  materials  to  help  utilities  address  communication  needs. 

4.  Promote  and  disseminate  guidance  materials  at  conferences,  through  associations,  on  websites,  etc. 

5.  Build  a  network  of  communicators  across  utilities,  agencies,  and  local  emergency  personnel  to  enhance 
communication,  clarity,  and  feedback. 


Champion 

Key  Milestones 

Immediate  Next  Steps 

■  Paul  Bennett,  New  York  City 
Department  of  Environmental 
Protection 

Potential  Partners 

■  Working  group  formed 

■  Communication  analysis 
completed 

■  Communication  guidance 
materials  developed 

■  Communication  published  and 
disseminated 

■  Communicator  network 
established 

■  Form  internal  working  group 

■  Begin  communication  analysis 
efforts 

■  AMWA,  AWWA,  AwwaRF, 
NACWA,  NAWC,  NRWA,  WEF, 
and  WERF 
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III.  Implementation 

The  WSCC  Strategic  Roadmap  will  continue  to 
evolve  as  industry  reacts  to  business  pressures, 
security  threats,  operational  constraints,  public 
demands,  and  unanticipated  events.  While  this 
strategic  roadmap  does  not  include  all  possible 
pathways  to  securing  the  sector,  it  provides  what 
the  WSCC  believes  to  be  a  sound  path  forward 
for  the  industry  that  identifies  both  immediate 
steps  and  long-term  goals  to  frame  the  sector’s 
actions  over  the  next  year.  It  will  guide  owners  and 
operators,  industry  associations,  and  government 
and  commercial  partners  in  planning,  training,  and 
preparing  for  potential  water  emergencies  so  that 
the  sector  can  become  more  proactive  in  managing 
its  risk  and  remain  appropriately  reactive  and 
responsive  during  an  event. 

By  working  together  to  develop  this  strategic 
roadmap,  the  WSCC  has  leveraged  a  broad 
range  of  operational  experience  to  identify  the 
most  pressing  industry  needs  and  prioritize 
actions  the  WSCC  can  take  to  begin  immediately 
enhancing  water  sector  security.  Utilities  face  a 
unique  responsibility  to  efficiently  provide  the 
public  with  clean,  safe  water.  Though  all  utilities 
have  taken  steps  to  meet  this  responsibility, 
without  a  collective,  concerted  effort  among  all 
industry  stakeholders,  utilities — especially  smaller 
ones — cannot  take  advantage  of  all  the  security 
capabilities  available  to  them.  Moving  forward,  the 
WSCC  must  provide  strong  leadership,  action,  and 
persistence  to  ensure  that  the  actions  laid  out  in 
this  strategy  are  implemented  to  the  sector’s  best 
ability. 

Figure  3.1  outlines  the  main  strategic  roadmap 
implementation  steps.  These  steps  are  designed  to 
catalyze  buy-in  with  the  strategic  roadmap,  and 
subsequently  launch  and  manage  the  WSCC’s  top 
priority  projects. 


Figure  3.1  Strategic  Roadmap  Implementation  Process 
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Secure  Water  Sector 


Catalyze  Change 

To  speed  implementation  of  water  sector  security 
initiatives,  the  WSCC  will  act  as  the  catalyst  for 
change  by  helping  the  water  sector  initiate  and 
implement  top  priority  security  programs  that 
empower  utilities,  advance  credible  security 
agendas,  and  lead  toward  a  secure  and  resilient 
drinking  water  and  wastewater  infrastructure. 

Socialize  Strategic  Roadmap 

To  encourage  buy-in  and  motivate  sector 
champions  to  step  forward,  the  WSCC  will  widely 
disseminate  the  plan  and  engage  leaders  across  the 
sector  to  participate  in  priority  activities. 

Form  Top  Priority  Teams 

Led  by  sector  champions,  the  WSCC  will  form  Top 
Priority  Teams  to  work  with  key  stakeholders  to 
provide  the  oversight  and  collaboration  needed  to 
act  on  the  top  priority  activities  identified  in  this 
plan.  Teams  will  work  to  obtain  sufficient  resources 
and  capabilities  required  for  taking  action. 
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Implement  Top  Priorities 

Top  Priority  Teams  will  create  work  plans, 
execute  the  plans,  assess  progress,  make  necessary 
adjustments,  and  deliver  tangible  results. 

Communicate  Results 

The  WSCC  will  develop  a  communications  strategy 
that  facilitates  active  stakeholder  participation, 
creates  metrics  for  success,  and  informs  the  public 
and  its  security  partners  about  positive  results  to 
ensure  a  secure  and  resilient  water  sector. 


Sustain  Momentum 

On  an  annual  basis,  the  WSCC  will  measure  the 
impact  of  the  strategic  roadmap  and  will  refine  and 
adapt  its  security  efforts  to  fulfill  its  mission  and 
improve  water-sector  security  today  and  in  the 
future. 
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V.  For  More  Information 

Peter  L.  Cook 
Executive  Director 

National  Association  of  Water  Companies 

(202) 833-8383 

Peter@nawc.com 

Cade  R.  Clark 

Director  of  State  Relations 

National  Association  of  Water  Companies 

(202)  466-3331 

Cade@nawc.com 
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Appendix  A.  Strategic  Roadmapping 
Process 


The  WSCC  Strategic  Roadmap  was  developed 
according  to  the  process  shown  in  Figure  A.l  and 
described  below. 

Establish  Vision  and  Goals 

In  2006,  under  Homeland  Security  Presidential 
Directive  7  (HSPD-7),  the  U.S.  Department 
of  Homeland  Security  (DHS)  developed  the 
National  Infrastructure  Protection  Plan  (NIPP)  to 
protect  the  Nations  critical  infrastructures,  the 
water  sector  being  one  of  them.9  As  part  of  the 
implementation  of  the  NIPP,  each  sector  developed 
a  Sector-Specific  Plan  (SSP)  outlining  goals  and 
objectives  to  secure  the  sector.  In  2007,  the  water 
sector  released  its  SSP,  which  establishes  a  vision 
and  broad-based  framework  for  addressing  water 
sector  security  needs. 

The  vision  and  goals  for  the  strategic  roadmap 
came  from  the  Water  SSP. 

Establish  Tactics 

In  February  2008,  the  U.S.  Critical  Infrastructure 
Partnership  Advisory  Council  (CIPAC)  Metrics 
Workgroup  for  Water  recommended  guidelines 
for  the  water  sector  to  report  security  measures  in 
Recommendations  of  the  CIPAC  Metrics  Workgroup 
for  Water. 10  These  measures  are  aligned  with  the 
“Ten  Features  of  an  Active  and  Effective  Security 
Program”  identified  in  the  Findings  of  the  Measures 
Testing  Group  for  National  Aggregate  Measures 
of  Water  Security11  and  the  Water  SSP  goals  and 
objectives.  The  tactics  for  this  strategic  roadmap 
were  drawn  from  the  CIPAC  initiative  to  be 
consistent  with  the  Water  SSP  framework. 

Identify  Trends  and  Drivers 

To  provide  a  context  for  planning  and  gain 
perspectives  on  the  key  concerns,  trends,  and 
drivers  that  will  affect  the  WSCC  and  its  public- 
private  partnership  in  2008  and  beyond,  the  WSCC 
Strategic  Planning  Working  Group  (WSCC- 
SPWG)  held  its  first  Strategic  Roadmapping 
Session  on  February  12,  2008,  at  the  Grand 
Hyatt  in  Washington,  D.C.  During  the  session, 

19  participants  from  the  water  sector,  including 


Figure  A.l  Strategic  Roadmapping  Process 
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WSCC  members,  owners  and  operators, 
associations,  and  subject  matter  experts,  offered 
collective  insight  on  the  high-level  security  needs 
of  the  sector.  The  workshop  results  were  published 
in  Water  Sector  Coordinating  Council  Strategic 
Roadmapping  Session  I  Summary  Results 12  and 
were  presented  to  the  council  for  review  and 
comment. 

Establish  Priorities 

A  second  Strategic  Roadmapping  Session  was 
held  on  May  13,  2008,  at  the  National  Association 
of  Clean  Water  Agencies  in  Washington,  D.C., 
to  develop  a  comprehensive  plan  that  identifies 
both  the  challenges  to  implementing  the  identified 
tactics,  and  the  activities  needed  to  address  those 
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challenges.  The  19  participants,  including  WSCC 
members,  owners  and  operators,  associations,  and 
subject  matter  experts,  identified  the  top  priorities 
for  the  WSCC  to  implement  in  2008-2009.  The 
workshop  results  were  published  in  Water  Sector 
Coordinating  Council  Strategic  Roadmapping 
Session  II  Summary  Results 13  and  were  presented  to 
the  council  for  review  and  comment. 


Prepare,  Review,  and  Publish  the 
Strategic  Roadmap 

The  draft  strategic  roadmap  was  developed  and 
circulated  among  all  participants  from  both 
meetings,  and  to  other  key  stakeholders  for 
added  insight  and  clarification.  The  comments 
of  all  reviews  have  been  integrated  into  this  final 
strategic  roadmap  document. 
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The  emergence  of  a  national  multi-organizational 
risk  management  system  is  impacting  the  water 
sector  in  every  area  of  its  operation.  Implementing 
the  NIPP  and  adopting  security  practices  consistent 
with  the  National  Incident  Management  System 
(NIMS)  and  the  Risk  Analysis  and  Management  for 
Critical  Asset  Protection  (RAMCAP)  is  complex, 
involves  financial  risk,  and  requires  cultural  change. 
As  such,  the  WSCC  frequently  operates  in  a  vicious 
cycle  rather  than  moving  forward  (see  Figure  B.l). 

A  formidable  barrier  to  positive  change  is  the 
escalating  multitude  of  security  improvements  the 
sector  needs  to  implement  using  its  severely  limited 
resources — a  challenge  that  has  substantial  impact 
on  what  services  and  upgrades  the  sector  can 
undertake.  Competing  demands  to  modernize/ 
repair  an  aging  infrastructure  and  meet  increasing 
regulatory  requirements  place  even  higher 
demands  on  the  sector,  making  significant  security 
improvements  practically  impossible. 

Utility  Resource  Constraints 

The  aging  workforce  is  rapidly  reaching 
retirement.14  Training  programs  will  need  to 
increase  and  occur  more  regularly  to  address  rising 
security  needs  and  turnover  in  experienced  staff.  A 
National  Infrastructure  Advisory  Council  (NIAC) 
study  estimated  that  the  cost  of  attaining  a  baseline 
security  posture  across  the  water  sector  could 
exceed  $750  billion.15  The  American  Water  Works 
Association  (AWWA)  estimates  that  municipal 
water  systems  would  spend  more  than  $1.6  billion 
just  to  ensure  control  of  access  to  critical  water 
system  assets.16  Yet,  Congress  still  has  not  provided 
funding  specifically  for  security  improvements. 
Although  some  funding  has  been  made  available 
through  the  U.S.  Environmental  Protection  Agency 
(EPA)  and  DHS,  competition  for  funds  is  severe, 
and  most  funds  continue  to  go  to  first  responders.17 
In  addition,  the  costs  of  replacing  aging  water 
distribution  pipelines  and  upgrading  wastewater 
systems  are  measured  in  tens  of  billions  of  dollars. 


Figure  B.l  Demands  on  WSCC 
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Cross-Sector  Interdependencies 

Residents,  businesses,  and  emergency  responders 
throughout  the  Nation  will  always  depend  on  water 
to  fight  fires.  Water  and  energy  are  inextricably 
linked.  Increasing  demand  for  energy  translates 
into  increasing  demand  for  water  to  cool  electric 
generation  stations.  Water  treatment  and 
distribution  are  becoming  more  energy  intensive  as 
water  quality  standards  improve  and  water  recycle/ 
reuse  practices  increase.  To  become  more  efficient, 
water  and  wastewater  systems  will  increasingly 
rely  on  and  become  more  interconnected  with 
cyber  systems  and  telecommunications.  Additional 
interdependencies  of  the  water  sector  include 
emergency  management  services,  health  care, 
natural  gas,  and  petroleum  liquids. 
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Table  B.l  Trends  and  Drivers  Influencing  Water  Sector  Security 


Utility  Resource 

Constraints 

■  Increasing  training  needs  due  to  aging  workforce,  staff  turnover,  and  reduction  in 
experienced  personnel 

■  Changing  regulations  and  increasing  public  demands  challenges  utilities  at  the  local  level 

■  Competing  capital  and  operating  investments 

Cross-Sector 

Interdependencies 

■  Increasing  complexity  and  interconnection  of  the  Nation  s  infrastructure 

■  Increasing  dependency  of  multiple  sectors  to  respond  to  and  recover  from  emergencies 

■  Increasing  reliance  on  rapidly  evolving  communication  systems 

■  Increasing  convergence  of  water  and  energy  operations 

Legislation  and 
Policy  Changes 

■  Legislation  and  policy  decisions  are  driving  RAMCAP  consistency  to  access  Federal 
resources 

■  Increasing  requirements,  if  included,  of  the  water  sector  in  Chemical  Facility  Anti-Terrorism 
Standards  (CFATS) 

■  Changing  political  climate 

■  Increasing  reach  of  Federal  strategies 

■  Evolving  partnership  model 

■  Impending  change  in  administration 

Public  Awareness  and 

Outreach 

■  Rapid  pace  of  information  exchange  is  diminishing  the  public  s  attention  to  security 

■  Ongoing  conflicts  in  media  messages  confuse  the  public 

■  Balancing  risk  communication  with  information  protection  is  difficult 

■  Evolving  communication  channels  challenges  message  delivery 

Owner/Operator 

Business  Environment 

■  Integrating  security  culture  into  business  culture 

■  Increasing  supply  chain  issues,  such  as  water  scarcity  and  meeting  growing  demand 

■  Increasing  economic  sensitivity  to  loss  of  service 

■  Approaching  limits  of  self-reliance 

■  Increasing  water  monitoring  requirements 

Sector-wide 

Issues 

■  Sustaining  interest  in  security  over  time  is  increasingly  difficult 

■  Accelerating  amount  of  information  to  comprehend  and  deliver 

■  Managing  risk  in  dynamic  “all-hazards”  environments 

■  Keeping  pace  with  a  rapidly  changing  threat  environment 

■  Keeping  pace  with  technology 

■  Growing  need  to  address  climate  change,  and  prepare  for  potential  pandemic 

■  Acculturating  the  National  Response  Framework  (NRF)  in  critical  infrastructure/key 
resources  (CIKR)  and  the  response  community 

Legislation  and  Policy  Changes 

Policy  makers  want  a  consistent  method  to 
measure  and  compare  the  security  needs  of 
the  Nations  critical  infrastructures,  and  so  are 
driving  RAMCAP  consistency  to  enable  priority 
setting.  Some  drinking  water  and  wastewater 
treatment  methods  require  the  use  of  hazardous 
chemicals.  As  a  result,  many  systems  may  need 
to  meet  new  Chemical  Facility  Anti-Terrorism 
Standards  (CFATS),  which  will  take  resources  away 
from  security  activities.  The  dynamic  political 
climate  and  pending  change  in  the  presidential 
administration  raises  uncertainties  about  future 
legislative  requirements  and  allocation  of 
resources. 


Public  Awareness  and  Outreach 

It  is  well  known  that  the  public  has  a  short 
attention  span.  With  the  rise  of  the  information 
age,  this  attention  span  has  decreased,  while  the 
amount  of  information  has  exponentially  increased. 
Mixed  media  messages  continue  to  confuse  the 
public.  Information  protection  requirements  are 
evolving,  while  consumers  are  demanding  access 
to  more  information  about  the  water  they  drink. 
The  rapid  pace  of  communications  technologies 
makes  it  difficult  to  choose  the  best  method  to 
deliver  messages  concerning  drinking  water  and 
wastewater  risks. 
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Owner/Operator  Business  Environment 

Making  a  major  culture  change  takes  significant 
time  and  resources,  slowing  uptake  of  security 
throughout  the  business  environment.  Population 
growth,  combined  with  source  water  limitations, 
is  creating  supply  chain  issues.  The  current  cost 
structure  of  the  water  sector  is  approaching 
its  limits  of  self  reliance;  many  businesses  and 
production  facilities  that  increasingly  rely  on  water 
cannot  afford  to  shut  down  due  to  a  loss  of  water 
service.  To  improve  water  quality  and  service, 
online  monitoring  needs  will  exponentially  increase 
in  the  next  few  years. 


Sector-Wide  Issues 

It  is  increasingly  difficult  to  manage  the  vast 
amount  of  security  information  flowing  between 
the  tens  of  thousands  of  public  water  systems 
and  wastewater  utilities  and  the  growing  network 
of  emergency  responders,  threat  analysts, 
and  government  needed  to  secure  the  water 
sector.  A  sample  of  key  stakeholder  groups  that 
coordinate  with  the  WSCC  is  shown  in  Figure 
B.2.  Both  the  threat  environment  and  advances  in 
water  technologies  are  rapidly  changing.  Public 
awareness  of  the  risks  associated  with  climate 
change  and  pandemic  flu  is  increasing.  In  addition, 
more  national  risk  management  issues  need  to 
be  integrated  into  the  water  sector,  including  the 
National  Response  Framework  (NRF)  into  critical 
infrastructure/key  resources  (CIKR)  and  the 
response  community. 


Figure  B.2  Sample  Key  Stakeholder  Groups 
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Appendix  C.  A  Framework  for  Securing  the 
Water  Sector 


Of  all  the  critical  infrastructures,  the  security  of  the 
water  sector  has  the  most  immediate  and  pervasive 
impact  upon  the  public  s  health  and  welfare.  While 
public-  and  private-sector  utilities  have  focused— 
both  within  their  organizations  and  across  industry 
and  sector  boundaries— on  improving  security 
through  multiple  initiatives,  there  is  a  sense  that 
progress  may  be  too  slow  and  the  response  may 
be  incomplete.  Security  challenges  will  continue 
to  overburden  the  stakeholders  in  the  Nations 
water  and  wastewater  infrastructure,  unless  the 
WSCC  moves  forward  with  more  concrete  and 
directed  efforts  toward  securing  the  water  sector.  A 
comprehensive  strategy  that  streamlines  and  drives 
the  efforts  of  industry  and  government  is  needed  to 
prepare  for  the  needs  of  tomorrow. 

Some  of  the  most  capable  experts  in  water  security, 
quality,  management,  engineering,  operations,  and 
maintenance  disciplines  work  within  the  WSCC 
and  its  network  of  associations,  owner/operators, 
and  subject  matter  experts;  however,  they  are 
widely  dispersed  and  fragmented  across  the  United 
States.  A  coordinated  strategy  that  can  align  these 
experts  along  a  strategic  path  to  mitigating  risk  in 
the  water  sector  will  help  change  the  water  sector  s 
security  approach  from  reactive  to  proactive. 

Vision 

As  defined  in  the  Water  SSP,  the  water  sector  has 
developed  the  following  vision  for  security: 


The  water  sectors  security  vision 
is  a  secure  and  resilient  drinking 
water  and  wastewater  infrastructure 
that  provides  clean  and  safe  water 
as  an  integral  part  of  daily  life. 


This  vision  assures  the  economic  vitality  of  and 
public  confidence  in  the  Nations  drinking  water 
and  wastewater  through  a  layered  defense  of 
effective  preparedness  and  security  practices  in  the 
sector. 


Security  Goals 

The  Water  SSP  identifies  four  security  goals 
outlining  the  comprehensive  protective  posture 
that  the  government  and  infrastructure  owner/ 
operators  are  striving  toward.  These  goals  will  drive 
development  of  protective  programs  and  measures 
of  success.  As  shown  in  Table  C.l  and  described 
below,  a  framework  emphasizing  specific  WSCC 
objectives  and  an  actionable  set  of  priorities  will 
provide  a  solid  foundation  for  water  sector  security 
initiatives. 

■  Sustain  protection  of  public  health  and  the 
environment.  Water  sector  systems  will  have  a 
security  culture  integrated  into  daily  business 
operations;  adequate  security  capabilities  to 
recognize  infrastructure  risk  that  affects  public 
health  and  economic  viability;  and  sufficient 
capabilities  to  analyze  threats  to  water  quality. 

■  Recognize  and  reduce  risks  in  the  water 
sector.  Water  sector  systems  will  be  able  to 
identify  vulnerabilities  based  on  knowledge 
and  best  available  information;  recognize 
potential  threats  through  sector  partners’ 
knowledge  base  and  communications;  and 
determine  public  health  and  economic  impact 
consequences  of  man-made  and  natural 
incidents. 

■  Maintain  a  resilient  infrastructure.  All 

utility  emergency  preparedness,  response,  and 
recovery  plans  will  emphasize  the  continuity 
of  drinking  water  and  wastewater  service. 
Mutual  aid  agreements  among  utilities  and 
states  will  be  established  and  implemented  with 
adequate  reach  throughout  the  sector.  Water 
sector  systems  will  develop  and  implement 
key  response  and  recover  strategies,  and 
have  deep  understanding  of  cross-sector 
interdependencies. 

■  Increase  communication,  outreach,  and 
public  confidence.  Water  sector  systems 
will  prepare  local  communities  to  be  able  to 
respond  to  a  natural  disaster  or  man-made 
incident.  Federal,  state,  and  local  officials  and 
agencies  will  effectively  communicate  and 
coordinate  threat  information  to  relevant 
utilities,  government,  and  the  public. 
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These  goals  provide  a  comprehensive  framework 
for  organizing  the  collective  efforts  of  industry, 
government,  and  other  key  stakeholders  to  achieve 
the  vision.  To  be  successful,  however,  specific 
tactics  must  be  executed  to  achieve  each  goal. 
Projects,  activities,  and  initiatives  that  result  from 
the  strategic  roadmap  should  be  tied  to  the  tactics 
shown  in  Table  C.l. 


Strategies  for  Securing  the  Water  Sector 

Strategies  for  accomplishing  the  four  water  sector 
goals  presented  in  Table  C.l  are  summarized  in 
Tables  C.2  through  C.5.  Each  goal  presents  distinct 
obstacles  that  must  be  overcome,  requires  specific 
achievements,  and  recommends  the  highest 
priorities  for  the  WSCC.  The  rapid  pace  of  change 
in  adversarial  capabilities,  public  perceptions, 
and  technologies,  combined  with  uncertainties  in 
weather,  markets,  regulations,  and  risk,  require  that 
the  water  sector  stay  vigilant  and  responsive  to  a 
variety  of  plausible  futures.  As  such,  the  WSCC  will 
review,  assess,  and  adjust  the  mix  of  activities  on  an 
annual  basis. 
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Table  C.l  Strategy  for  Securing  the  Water  Sector 


Vision 


The  water  sector’s  security  vision  is  a  secure  and  resilient  drinking  water  and  wastewater 
infrastructure  that  provides  clean  and  safe  water  as  an  integral  part  of  daily  life. 


Challenges 

■  Severe  competition  for  funds  limits  resources  available  for 
planning,  training,  simulations,  and  other  security  activities 

■  No  clarity  about  what  an  adequate  level  of  security  means 

■  Impact  of  the  loss  of  water  service  is  not  well  understood 

■  Difficult  to  apply  uniform  requirements  to  large  number 
and  highly  diverse  type  of  water  and  wastewater  utilities  for 

Risk  Analysis  and  Management  for  Critical  Asset  Protection 
compliance 

■  Lack  of  utility  awareness  about  the  opportunity  to  access  funds 
through  National  Incident  Management  System  compliance 

■  Limited  awareness  in  the  funding  community  and  among  public 
officials  on  the  critical  needs  of  water  and  wastewater  systems 

■  Information  overload  limits  sector  uptake  of  and  response 
to  security  initiatives;  makes  it  difficult  to  uncover  relevant 
information 

■  Uncertainties  about  how  best  to  communicate  with  the  public 

Goals 

Sustain  Protection  of  Public  Recognize  and  Reduce  Risks  in 

Health  and  the  Environment  the  Water  Sector 

u  •  *  •  „  D  .i.  *  Increase  Communication, 

Maintain  a  Resilient  n  t  l  nnj  p,,ui;r 

"  0U,,eCo„hfidenncePUb"C 

Tactics 

Product  Quality 

■  Conduct  routine 
supplemental  monitoring 
or  more  in-depth  analysis 
beyond  what  is  required 
to  identify  abnormal  water 
quality  conditions 

■  Establish  relationships  with 
public  health  networks 

to  interpret  public  health 
anomalies  for  the  purpose 
of  identifying  waterborne 
public  health  impacts 

■  Monitor  and  evaluate 
customer  complaints  for 
possible  indications  of  water 
quality  or  other  security 
threats 

■  Establish  protocols  (i.e., 
consequence  management 
plans)  for  interpreting  and 
responding  to  indications 
of  water  quality  anomalies, 
including  events  where  the 
source  and  impact  on  water 
are  uncertain 

Security  Preparedness 

■  Integrate  security  and 
preparedness  into 
budgeting,  training,  and 
management  responsibilities 

■  Incorporate  security 
into  planning  and  design 
protocols  applying  to  all 
assets  and  facilities 


Risk  Assessment 

■  Evaluate  disinfection 
methods  considering  water 
quality,  public  health,  and 
security  issues 

Vulnerabilities 

■  Review  vulnerability 
assessments  annually  and 
update  periodically 

■  Establish  physical  and / 
or  procedural  controls 
to  safeguard  hazardous 
chemicals  (including 
gaseous  chlorine) 

Threats 

■  Receive  screened, 
validated,  and  timely  threat 
information  from  one  or 
more  trusted  sources 

■  Develop  plan  to  increase 
utility  security  in  response 
to  a  threat 

Intrusion  Detection 

■  Enhance  intrusion  detection 
capability  of  critical  assets 


Business  Continuity 

■  Develop  written  business 
continuity  plans 

■  Install  redundancy,  such  as 
backup  power,  for  critical 
operations 

Emergency  Response 

■  Develop  emergency 
response  plans  and  maintain 
them  (conduct  training 

and  exercise;  review  and 
periodically  update) 

■  Adopt  National  Incident 
Management  System 

■  Begin  process  of 
establishing  aid  or 
assistance  agreements,  such 
as  a  Water /Wastewater 
Agency  Response  Network 
membership 

■  Determine  percent 
minimum  daily  demand 
with  a  non-functional 
primary  production/ 
treatment  plant 


Networking 

■  Engage  in  emergency 
preparedness  networking 
activities 

■  Engage  in  collaborative 
response  networking 
activities 

Crisis  Communications 

■  Develop  crisis 
communication  plans 


WSCC  Objectives 


The  water  sector  will  have 
consequence  management  and 
security  preparedness  plans 
to  maintain  public  health  and 
environmental  protection. 


The  water  sector  will  have 
screened,  validated,  and 
timely  vulnerability  and  threat 
information  to  make  informed 
risk  management  decisions. 


The  water  sector  will  have 
business  continuity  and 
emergency  response  plans  to 
ensure  the  economic  vitality  of 
the  utilities  and  the  communities 
they  serve. 


The  water  sector  will  have  crisis 
communication  plans  and  engage 
in  collaborative  emergency 
preparedness  and  incident 
response  networks  to  foster 
public  confidence. 
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Goal:  Sustain  Protection  of  Public 
Health  and  the  Environment 

Water  and  wastewater  systems  seek  to  provide  the 
highest  possible  quality  of  product  economically 
and  reliably,  while  facing  a  myriad  of  chemical 
and  biological  threats  to  their  infrastructures. 

A  well-defined  consequence  management  plan 
(CMP)  ensures  utilities  are  prepared  to  interpret 
and  respond  to  indications  of  product  quality 
anomalies.  Product  quality  is  defined  as  potable 
water,  treated  effluent,  and  process  residuals  that 
are  in  full  compliance  with  regulatory  and  reliability 
requirements  and  consistent  with  customer,  public 
health,  and  ecological  needs.  Security  preparedness 
ensures  leadership  and  staff  work  together  to 
anticipate  and  avoid  problems.  A  comprehensive 
security  plan  proactively  identifies,  assesses, 
establishes  tolerance  levels  for,  and  effectively 
manages  a  full  range  of  business  risks  (including 
legal,  regulatory,  financial,  environmental,  safety, 
security,  and  natural  disaster  related)  in  a  proactive 
way  consistent  with  industry  trends  and  system 
reliability  goals.18 


To  maintain  public  health  and 
the  environment,  the  WSCC 
aims  to  help  water  sector  utilities 
complete  and  exercise  consequence 
management  and  security 
preparedness  plans. 


An  overview  of  the  challenges,  tactics,  and  needed 
activities  for  achieving  this  objective  is  shown  in 
Table  C.2. 


Challenges 

A  major  challenge  for  utility  staff  is  to  effectively 
manage  multiple  product  quality,  delivery,  and 
security  objectives  while  maintaining  regulatory 
compliance  and  affordability  of  drinking  water  and 
wastewater  services.  The  interrelationships  of  these 
objectives  are  complex,  and  available  literature 
can  be  confusing.  Supplemental  monitoring  costs 
are  difficult  to  justify,  especially  in  a  small  system. 
In  addition,  the  mix  and  number  of  contaminants 
are  extremely  diverse  and  numerous,  making 
it  impractical  to  manage  the  risk  of  all  possible 
contamination  events. 

Needed  Activities 

Product  quality.  A  top  priority  for  the  WSCC  is  to 
provide  guidance  on  developing  CMP  detection  of 
contamination  protocols.  To  avoid  confusion,  the 
roles  and  responsibilities  of  all  security  partners 
must  be  clarified.  Clear  guidance  for  utilities 
and  associations  on  consequence  management 
planning  can  help  utilities  evaluate  and  prioritize 
treatment  and  monitoring  options  for  multiple 
interdependent  product  quality  objectives. 

Security  preparedness.  Security  awareness  is 
critical  to  obtaining  buy-in  organization  wide 
and  sector  wide.  The  WSCC  can  draw  from  its 
network  of  experts  and  public- private  resources  to 
coordinate  the  appropriate  training,  but  it  must  be 
understandable  and  relevant  enough  to  everyone  to 
influence  action.  Ensuring  the  sector  has  adequate 
tools  to  design,  prioritize,  and  audit  security 
against  other  business  and  operational  issues  will 
enable  utilities  to  integrate  security  into  everyday 
operations  and  prepare  the  sector  for  not-so- 
everyday  events,  such  as  pandemic  flu. 
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Table  C.2  Priority  Activities  Needed  to  Sustain  Protection  of  Public  Health  and  the  Environment 
(Bold  blue  text  indicates  top  priority) 


Goal  —  Sustain  Protection  of  Public  Health  and  the  Environment 


WSCC  Objective 

The  water  sector  will  have  security  preparedness  and  consequence  management  plans  to  maintain 
public  health  and  environmental  protection. 

Challenges 

Security  Preparedness  &  Water  Quality 

■  No  clarity  as  to  what  level  of  security  is  appropriate  with  design 

■  Separating  voluntary  framework  from  due  diligence 

■  Defining  due  diligence 

■  Getting  sufficient  metrics  reporting  to  help  the  sector  define  practices 

■  Dealing  with  incomplete  information  for  establishing  protocols 

■  Routine  supplemental  monitoring  proves  a  very  difficult  value  proposition  for  small  utilities 

■  Impact  of  the  loss  of  water  service  is  not  well  understood 

Needed  Activities 

Product  Quality 

■  Provide  guidance  on  consequence  management  detection  of  contamination  protocols 

■  Define  a  clear  consequence  management  plan  that  determines  “who  makes  the  call” 

■  Determine  what  security  level  is  “enough”  and  consider  due  diligence  issues 

■  Provide  decision  aid  for  characterizing  an  incident  and  determining  an  appropriate  level  of  response 

■  Develop  performance  standards  for  contamination  detection  both  inside  and  outside  the  sector,  incorporated 
through  DHS/EPA 

■  Promote  the  Sector-Specific  Plan  (SSP) 

■  Promote  the  “10  Features  of  an  Active  and  Effective  Security  Program”  identified  by  the  National  Drinking  Water 
Advisory  Council 

■  Socialize  the  “features”  and  metrics  to  increase  comfort  and  demonstrate  action 
Security  Preparedness 

■  Simplify  security  culture 

■  Improve  security  training  exercises  and  integrate  security  management  into  operations 

■  Institute  risk-reduction  training  on  both  general  awareness  and  issue-specific  levels 

■  Integrate  security  into  all  aspects  of  business  and  operations  planning 

■  Optimize  security  planning  in  the  context  of  asset  management 

■  Develop  a  tool  to  prioritize  security  against  other  issues  (infrastructure,  regulations,  original  equipment 
manufacturers  [OEM],  etc.) 

■  Institute  security  management  programs  that  include  security  design  and  security  audit 

■  Define  and  estimate  the  regulatory  impacts  and  relief  requirements  during  a  pandemic  flu 
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Goal:  Recoanize  and  Reduce  Risks  in 
the  Water  Sector 

Risk  analysis  is  the  process  through  which  the 
three  components  of  risk — threat,  vulnerability, 
and  consequence — will  be  collectively  analyzed  to 
determine  the  utility’s  and  sector’s  security  posture. 
All  risk  assessments  are  conducted  at  the  asset 
level;  local  conditions  dictate  the  priority  of  the 
components.  Threat  information  is  provided  by  the 
Federal  government.  Water  sector  risk-assessment 
tools  enable  drinking  water  and  wastewater  utilities 
to  identify,  inventory,  and  assess  the  criticality  of 
utility-specific  components  in  detail. 


To  better  inform  decision  makers 
on  the  appropriate  levels  and 
allocation  of  risk  mitigation 
measures,  the  WSCC  will  facilitate 
the  exchange  of  screened,  validated, 
and  timely  vulnerability  and  threat 
information  among  sector  partners. 


An  overview  of  the  challenges,  tactics,  and  needed 
activities  to  achieve  this  objective  is  shown  in  Table 
C.3. 

Challenges 

While  vulnerability  assessments  have  improved 
a  utility's  understanding  of  the  risk  to  its  critical 
systems,  the  capabilities  to  fully  understand  the 
risk  at  the  local,  regional,  and  national  level  have 
just  begun  to  take  shape.  Lacking  the  ability  to 
determine  risk,  utilities  cannot  build  a  compelling 
business  case  for  security  improvements  and  risk 
unknowingly  leaving  their  most  critical  assets 
vulnerable  to  attack.  In  addition,  a  lack  of  clearly 
defined  security  requirements  hampers  the  sector  s 
ability  to  convince  the  public  that  it  is  doing  a  good 
job.  Without  defined  requirements,  it  is  difficult 
to  convince  the  government  that  the  sector  needs 
more  resources  to  maintain  an  adequate  security 
posture. 


Needed  Activities 

Risk  Assessment.  A  top  priority  for  the  WSCC 
is  to  encourage  a  strong  response  to  the  Critical 
Infrastructure  Partnership  Advisory  Council 
(CIPAC)  Metrics  Survey.  A  response  that 
includes  the  majority  of  the  sector  will  provide 
a  solid  baseline  to  measure  the  security  posture 
of  today  and  progress  in  the  future.  Shifting 
perspectives  from  vulnerabilities  assessment  to 
risk  management  will  enable  the  development  of 
a  common  framework  and  facilitate  RAMCAP 
compliance. 

Vulnerabilities.  A  top  priority  for  the  WSCC  is 
to  promote  a  flexible  and  scalable  approach  to 
RAMCAP.  One  approach  is  to  develop  an  efficient, 
accepted  methodology  based  on  existing  models. 
Supported  by  the  WSCC,  the  RAMCAP  Working 
Group  has  been  designing  this  approach  and  will  be 
ready  to  deploy  a  refined  RAMCAP  model  in  2009. 

Consequences.  Water  is  inextricably  linked  to 
most  of  the  U.S.  critical  infrastructures.  Yet  many 
outside  the  sector  still  do  not  understand  the 
interdependencies  with  water.  By  conducting  a 
study  of  economic  impacts  caused  by  the  loss  of 
water  service  and  defining  the  risk  of  distribution 
and  collection  systems,  the  sector  will  be  able  to 
develop  a  better  business  case  to  EPA  and  DHS 
for  allocating  resources  and  funding  for  security 
improvements  in  the  water  sector.  The  WSSC 
should  also  continue  to  support  the  WSCC  Cyber 
Security  Working  Group  in  developing  and 
implementing  the  near-term  milestones  of  the 
2008  Roadmap  to  Secure  Control  Systems  in  the 
Water  Sector. 

Intrusion  Detection.  An  acute  situational 
awareness  is  essential  to  interpreting  and 
responding  to  attacks  or  accidental  disruptions  of 
water  and  wastewater  service.  Reliable  and  effective 
sensors  need  to  be  developed  to  establish  an  early 
warning  system  of  a  possible  contamination  event 
to  increase  the  speed  of  the  response. 
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Table  C.3  Priority  Activities  Needed  to  Recognize  and  Reduce  Risks  in  the  Water  Sector 
(Bold  blue  text  indicates  top  priority) 


Goal  —  Recognize  and  Reduce  Risks 


WSCC  Objective 

The  water  sector  will  have  screened,  validated,  and  timely  vulnerability  and  threat  information  to 
make  informed  risk  management  decisions. 

Challenges 

Risk  Assessment 

■  Issues  remain  that  hinder  Risk  Analysis  and  Management  for  Critical  Asset  Protection  (RAMCAP)  compliance 

■  Vulnerability  Assessment  (VA)  tools  not  as  effective  as  they  need  to  be 

■  Difficult  to  know  how  far  to  go  with  corrective  actions  from  VAs 

Vulnerabilities 

■  Difficult  to  convince  the  public  we  are  doing  a  good  job 
Threats 

■  Not  all  utilities  are  submitting  incident  information  because  it  is  not  a  requirement  and  there  is  a  lack  of  awareness 

■  Cyber  issues  dominate  incident/threat  reporting 

■  Difficult  to  uncover  relevant  information 
Intrusion  Detection 

■  Technology  limitations  (e.g.,  sensors) 

Needed  Activities 

Risk  Assessment 

■  Maximize  response  to  CIPAC  Metrics  Survey 

■  Shift  vulnerability  assessment  discussion  to  risk  management 

■  Institute  a  common  risk  assessment  framework 

Vulnerabilities 

■  Promote  to  government  a  flexible  and  scalable  approach  to  RAMCAP 

■  Develop  an  efficient,  accepted  methodology  and  an  appropriate  schedule  for  conducting  vulnerability  assessments 

■  Provide  guidance  for  protection  of  hazardous  chemicals 

■  Define  vulnerabilities  and  threats  to  distribution  and  collection  systems 

■  Increase  use  of  existing  and  new  simulation  and  security  self  assessment  tools  through  education/outreach 
Consequences 

■  Better  understand  economical  and  physical  interdependencies  to  determine  consequences 

■  Integrate  the  Roadmap  to  Secure  Control  Systems  in  the  Water  Sector 

■  Educate  people  outside  of  the  sector  about  interdependencies 

■  Conduct  study  to  measure  economic  impact  of  the  loss  of  water  service  and  enable  tiering 

Intrusion  Detection 

■  Develop  and  implement  improved  sensors  for  contaminant  monitoring/detection 

■  Develop  real-time  reliable  sensors  with  robust  communication  to  identify/monitor  contamination 
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Goal:  Maintain  a  Resilient 
Infrastructure 

A  proactive  approach  to  security  requires  ongoing, 
timely,  cost-effective,  reliable,  and  sustainable 
performance  and  security  improvements  in  all 
facets  of  operations  in  all-hazard  conditions.  To 
further  optimize  business  operations,  a  well- 
defined  business  continuity  plan  (BCP)  for  the 
private  sector  (also  known  as  a  continuity  of 
operations  plan  [COOP]  for  the  public  sector) 
factors  in  the  potential  financial,  human  effects, 
and  cross-sector  impacts  of  a  potential  crisis. 
Different  from  a  BCP/COOP,  an  emergency 
response  plan  (ERP)  has  eight  core  elements: 
system  specific  information;  community  water 
system  (CWS)  roles  and  responsibilities; 
communication  procedures  (who,  what,  and  when); 
personnel  safety;  identification  of  alternate  water 
sources;  replacement  equipment  and  chemical 
supplies;  property  protection;  and  water  sampling 
and  monitoring.19 


The  WSCC  will  facilitate  the 
completion  and  practice  of  business 
continuity  and  emergency  response 
plans  to  optimize  the  business 
operations  of  water  sector  utilities 
and  ensure  their  economic  vitality, 
as  well  as  the  communities  they 
serve. 


An  overview  of  the  challenges,  tactics,  and  needed 
activities  to  achieve  this  objective  is  shown  in  Table 
C.4. 


Challenges 

Competing  Federal  priorities  and  limited 
understanding  by  the  Federal  government  of 
critical  water  sector  needs  has  left  few  resources 
for  implementing  security  initiatives,  such  as 
training  and  simulations.  While  some  BCPs/ 
COOPs  have  been  developed,  few  municipalities/ 
states  have  approved  these  plans  and  BCP/COOP 
requirements  are  not  consistent  among  them. 
Information  overload  has  bombarded  utilities  with 
new  terminology,  plans,  and  regulations  to  learn 
and  comply  with,  causing  confusion  and  making  it 
difficult  to  uncover  the  most  relevant  information. 
Unfortunately,  many  utilities  miss  opportunities  to 
receive  Federal  funding  because  they  still  do  not 
understand  what  it  means  to  be  consistent  with  the 
NIMS  (National  Incident  Management  System). 

Needed  Activities 

Business  continuity.  A  top  priority  for  the  WSCC 
is  to  provide  guidance  on  BCP/COOP  development 
in  the  water  sector.  To  augment  these  plans,  a 
cross-sector  interdependency  assessment,  supply- 
chain  analysis,  and  power  reliability  evaluation 
should  be  conducted. 

Emergency  response.  A  top  priority  for  the 
WSCC  is  to  encourage  utilities  to  engage  with  local 
emergency  responders  as  a  first  step  to  developing 
ERPs  and  mutual-  and  aid-assistance  agreements, 
which  are  essential  to  be  consistent  with  NIMS. 

It  is  necessary  to  find  and  obtain  more  resources 
for  utilities  to  conduct  training  and  simulations  to 
ensure  they  have  the  knowledge  and  skills  to  fully 
engage  during  an  emergency.  The  WSCC  can  build 
on  strategies,  experience,  and  networks  already  in 
place  to  accelerate  these  efforts. 
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Table  C.4  Priority  Activities  Needed  to  Maintain  a  Resilient  Infrastructure 
(Bold  blue  text  indicates  top  priority) 


Goal  —  Maintain  a  Resilient  Infrastructure 


WSCC  Objective 

The  water  sector  will  have  business  continuity/ continuity  of  operations  plans  and  emergency 
response  plans  to  ensure  the  economic  vitality  of  the  utilities  and  the  communities  they  serve. 

ChaMenges 

■  BCP/COOP 

■  Limited  resources  available  for  COOPs,  including  training,  simulations,  etc. 

■  Limited  awareness  of  need  to  show  conformance  with  National  Incident  Management  System  (NIMS)  to  access 
funding 

■  Municipalities/states  have  not  approved  plans 

■  No  consistency  in  COOP  requirements  between  states 

■  COOP  is  often  confused  with  Emergency  Response  Plan  (ERP)  in  small  utilities 
Backup  Power 

■  Lack  of  clarity  in  defining  “critical  operations”  and  “essential  services”  (redundancy  is  more  important  than  just 
backup  power) 

■  Inconsistent  requirements  among  states 

■  Implications  for  interdependent  operations  are  uncertain 

■  Security  does  not  drive  design 

■  “Uneven”  business  case  for  backup  power — partly  due  to  lack  of  understanding  of  resources 
Emergency  Response  Plans 

■  Access  to  funds  requires  compliance  with  NIMS 

■  Government  training  is  confusing 

Adoption  of  NIMS 

■  Misunderstanding  of  what  NIMS  compliance  means 

■  Lack  of  common  terminology 

Needed  Activities 

Business  Continuity 

■  Provide  guidance  on  business  continuity/continuity  of  operations  planning  in  the  water  sector 

■  Conduct  a  cross-sector  interdependency  assessment 

■  Conduct  supply-chain  analysis 

■  Update  or  develop  a  handbook  to  evaluate  power  reliability 
Emergency  Response 

■  Engage  with  local  emergency  responders 

■  Join  or  help  establish  mutual  aid/assistance  (i.e.,  Water/ Wastewater  Agency  Response  Network  [WARN]) 

■  Improve  training  for  emergency  response  personnel  and  determine  the  right  terminology 

■  Learn  the  language  of  ERP  and  NIMS 

■  Build  on  strategies  and  experience  we  have  in  place 

■  Increase  resources  to  utilities  to  conduct  simulations 

■  Develop  readily  acceptable,  multi-jurisdictional,  universal  credential 

■  Institute  a  functional  and  reliable  communication  system  for  all  first  responders 
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Goal:  Increase  Communication, 
Outreach,  and  Public  Confidence 

Risk  communication — whether  effective  or  not — 
will  directly  influence  what  happens  following  a 
potentially  compromising  event.  For  example,  an 
effective  message  can  provide  needed  information 
to  garner  support  or  calm  a  nervous  public,  while 
a  poor  statement  can  undermine  public  trust  and 
confidence  and  possibly  aggravate  any  situation. 

To  be  effective,  communication  plans  designed  for 
crisis  conditions  must  have  established  networks 
of  two-way  communication  among  the  public, 
news  media,  policy  makers,  water/wastewater 
utilities,  regulatory  agencies,  public  health  officials, 
emergency  responders,  and  other  authorities 
involved  in  emergency  response  and  recovery.20 
Trust  takes  time  and  is  difficult  to  earn.  Because 
the  most  trusted  partnerships  are  built  over  time, 
water  sector  utilities  should  communicate  regularly 
with  their  community,  especially  when  good  news 
is  available. 


To  foster  public  confidence,  the 
WSCC  will  aid  in  the  development 
of  crisis  communication  plans 
and  collaborative  emergency 
preparedness  and  incident  response 
networks. 


An  overview  of  the  challenges,  tactics,  and  needed 
activities  for  achieving  this  objective  is  shown  in 
Table  C.5. 

Challenges 

Although  most  utilities  recognize  the  importance 
of  communicating  risk  with  the  public,  many  do 
not  have  the  expertise  or  resources  to  develop 
crisis  communication  plans.  Trust  is  a  sensitive 
issue  that  can  be  lost  in  an  instant  from  just  one 


piece  of  poorly  delivered  or  misguided  information. 
Overcoming  public  mistrust  is  an  uphill  battle. 

The  high  level  of  emotions  and  stress  in  emergency 
situations,  combined  with  the  diverse  audiences 
requiring  communication,  has  left  utilities 
wondering  where  to  begin  when  developing  a  crisis 
communication  strategy.  Unfamiliarity  of  process 
and  staff  among  the  vital  communication  channels 
inhibits  cooperation  among  all  involved. 

Needed  Activities 

Networking.  Top  priorities  for  the  WSCC 
include  aligning  EPA  and  DHS  priorities  with 
water  sector  needs  to  increase  resources  for 
sector  security  initiatives,  and  developing  a 
strategy  to  manage  government  workload  to 
increase  council  effectiveness.  The  WSCC  needs 
to  educate  utilities  on  the  limitations  of  sharing 
information  to  maintain  trust  among  the  sector 
and  its  partners.  Education  and  training  on  cross- 
sector  interdependencies  is  also  needed.  To  foster 
its  security  partnerships,  the  WSCC  will  should 
develop  better  relationships  with  other  Sector- 
Coordinating  Councils,  Information  Sharing 
and  Analysis  Center  (ISAC)  Councils,  and  the 
Partnership  for  Critical  Infrastructure  Security 
(PCIS). 

Crisis  communication.  A  top  priority  for 
the  WSCC  is  to  facilitate  the  development  of 
utility  responder  communication  plans  that  can 
reach  large  numbers  of  people  with  clear  and 
credible  health,  safety,  and  security  messages. 

With  guidance  from  the  WSCC,  utilities  can 
enhance  knowledge  and  understanding  of  a  well- 
constructed  responder  communication  plan  that, 
when  practiced  and  implemented,  will  inform 
the  public,  reduce  misinformation,  and  provide 
a  valuable  foundation  for  informed  decision 
making.  As  a  first  step,  WSCC  can  leverage  EPAs 
message-mapping  activities.  In  addition,  efforts 
must  be  made  to  balance  public-relation  efforts 
with  information  protection  at  all  levels,  and  ensure 
information  is  timely. 
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Table  C.5  Priority  Activities  Needed  to  Increase  Communication,  Outreach,  and  Public  Confidence 
(Bold  blue  text  indicates  top  priority) 


Goal  —  Increase  Communication,  Outreach,  and  Public  Confidence 


WSCC  Objective 

The  water  sector  will  have  crisis  communication  plans  and  engage  in  collaborative  emergency 
preparedness  and  incident  response  networks  to  foster  public  confidence. 

ChaMenges 

Networking  and  Crisis  Communication 

■  Limited  cooperation  among  communication  channels 

■  Difficult  to  communicate  directly  with  customers  and  restore  public  confidence  due  to  communications  personnel 
having  limited  awareness  of  resources 

■  Limited  awareness  in  the  funding  community  and  among  public  officials 

■  Calming  the  media  and  managing  the  message 

■  Limited  awareness  in  the  emergency  response  community 

■  Overcoming  public  mistrust 

Needed  Activities 

Networking 

■  Align  security  partner  (i.e.,  EPA,  DHS)  priorities  with  water  sector  needs 

■  Develop  strategy  to  manage  government  (i.e.,  EPA ,  DHS)  workload 

■  Educate  utilities  on  limitations  of  sharing  information 

■  Promote  cross-sector  interdependency  awareness  training;  educate  other  sectors  on  the  value  of  water 

■  Develop  ongoing  forum  to  resolve  interdependency  concerns  and  risk  reduction  needs 

■  Develop  better  relationships  with  other  Sector-Coordinating  Councils  (SCCs) 

■  Determine  how  to  better  leverage  the  Information  Sharing  and  Analysis  Center  (ISAC)  Council  and  the  Partnership 
for  Critical  Infrastructure  Security  (PCIS) 

■  Refine  the  NIPP  partnership  model 
Crisis  Communication 

■  Provide  guidance  on  water  and  wastewater  utility  responder  communications  planning 

■  Promote,  support,  and  join  the  Water  ISAC;  encourage  incident  reporting  to  Water  ISAC 

■  Create  communication/outreach  metrics  that  will  provide  benchmarking  for  utilities  to  assess  programs  and  needs 

■  Leverage  EPAs  message-mapping  activities 

■  Maintain  communication  during  good  times  and  stay  engaged  with  the  public 

■  Balance  public  relation  efforts  with  information  protection 

■  Integrate  and  protect  information  at  all  levels,  and  ensure  it  is  timely 
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Appendix  E.  Acronyms 


AMWA 

Association  of  Metropolitan  Water 
Agencies 

AWWA 

American  Water  Works  Association 

AwwaRF 

AWWA  Research  Foundation 

BCP 

business  continuity  plan 

CFATS 

Chemical  Facility  Anti-Terrorism 
Standards 

CIKR 

critical  infrastructure/key  resources 

CIPAC 

Critical  Infrastructure  Partnership 
Advisory  Council 

CMP 

Consequence  Management  Plan 

COOP 

continuity  of  operations  plan 

CSWG 

Cyber  Security  Working  Group 

cws 

community  water  system 

DHS 

U.S.  Department  of  Homeland  Security 

DOE 

U.S.  Department  of  Energy 

EPA 

U.S.  Environmental  Protection  Agency 

ERP 

emergency  response  plan 

GCC 

Government  Coordinating  Council 

HSPD-7 

Homeland  Security  Presidential 
Directive  7 

ISAC 

Information  Sharing  and  Analysis 
Center 

NACWA 

National  Association  of  Clean  Water 
Agencies 

NAWC  National  Association  of  Water 

Companies 

NIAC  National  Infrastructure  Advisory 

Council 

NIMS  National  Incident  Management  System 

NIPP  National  Infrastructure  Protection  Plan 

NRF  National  Response  Framework 

NRWA  National  Rural  Water  Association 

NYC  DEP  New  York  City  Department  of 
Environmental  Protection 

PCIS  Partnership  for  Critical  Infrastructure 

Security 

RAMCAP  Risk  Analysis  and  Management  for 
Critical  Asset  Protection 

SCC  Sector  Coordinating  Council 

SPWG  Strategic  Planning  Working  Group 

SSA  Sector-Specific  Agency 

SSP  Sector-Specific  Plan 

VA  vulnerability  assessment 

WARN  Water /Wastewater  Agency  Response 

Network 

WEF  Water  Environment  Federation 

WERF  Water  Environment  Research 

Foundation 

WSCC  Water  Sector  Coordinating  Council 
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